docs(infra): app4 + core-bu provisioning, migration plan, verified inventory

- migration-plan-app4-core-bu-2026-09-15.md: 8-phase plan (Nuremberg decision,
  provider-diversity gap, acceptance criteria, rollback, DNS/Caddy checklist)
- core-service-inventory-2026-09-15: verified Core inventory, ~30 customer-facing
  services (the Aug 15 plan listed 5), 3 DocuSeal instances, TimeTrex Postgres,
  dead Caddy routes
- reference-update-matrix-2026-09-15: 52 artifacts that name a host
- fix naming collision: 6 files called the Hetzner box core-bu, the name core-bu
  now claims; app1-bu = 5.161.225.131, core-bu = 159.195.204.203 (netcup Nuremberg)
- correct the false provider-diversity claim (the standby is now netcup too)
- supersede app4-migration-plan.md (wrong region reported, silent on core-bu)

README.md

@@ -78,7 +78,7 @@
   - Daily snapshots: 1 AM + 1 PM, 60-day retention, /opt/backup-restore/snapshots
 
 ### Core-BU (Warm Standby)
-- **Hostname:** core-bu
+- **Hostname:** app1-bu
 - **IP:** 5.161.225.131
 - **Provider:** Hetzner CPX21
 - **Specs:** 3 vCPU, 4 GB RAM, 80 GB SSD
@@ -91,7 +91,7 @@
 - **wphost02:** 5.161.62.38 (Hetzner CPX21) — **DECOMMISSIONED (2026-08-28)** — deleted from Hetzner account; sites migrated to app3
 - **Ollama:** Removed from Core (systemd) and app1 (Docker) Jul 17
 
-> **Hetzner Cloud (current):** As of 2026-08-28, the Hetzner Cloud API returns exactly **one** server — **app1-bu / core-bu** (`5.161.225.131`, CPX21, warm standby for Core). All other Hetzner boxes (old-ai, wphost02) are decommissioned/deleted.
+> **Hetzner Cloud (current):** As of 2026-08-28, the Hetzner Cloud API returns exactly **one** server — **app1-bu / app1-bu** (`5.161.225.131`, CPX21, warm standby for Core). All other Hetzner boxes (old-ai, wphost02) are decommissioned/deleted.
 
 ---
 
@@ -174,7 +174,7 @@ Direct API keys for all providers. Claude Sonnet 5 for primary quality, then dir
 | app2-backup | Daily 2:30 AM | s3://hermes-vps-backups/app2/ | Traccar, Gitea, Hudu, UNMS, UniFi |
 | app3-backup | Daily 3 AM | s3://hermes-vps-backups/app3/ | CloudPanel, MySQL, WordPress |
 | ~~wphost02-backup~~ | ~~Daily 5 AM~~ | ~~s3://hermes-vps-backups/wphost02-backup/~~ | **REMOVED — wphost02 decommissioned 2026-08-28** |
-| warm-standby-sync | Every 10 min | core-bu ← S3 | DR readiness |
+| warm-standby-sync | Every 10 min | app1-bu ← S3 | DR readiness |
 
 ---
 
@@ -274,7 +274,10 @@ All SSL certificates issued via Let's Encrypt through Caddy. All certs auto-rene
 
 - **DNS trap:** `itpropartner.com` uses SiteGround nameservers. Cloudflare zone is NOT authoritative. Always verify with `dig NS domain.com` before creating records.
 - **SiteGround:** No API access. All DNS changes are manual through SiteGround panel.
-- **Provider diversity:** core-bu stays at Hetzner specifically so a netcup outage can't kill both Core and standby simultaneously.
+- **Provider diversity:** app1-bu stays at Hetzner specifically so a netcup outage can't kill both Core and standby simultaneously.
+  **2026-09-15 update:** the new standby of record is `core-bu` (netcup, Nuremberg, `159.195.204.203`) — same provider as Core, so it
+  gives regional separation but NOT provider separation. Provider diversity now holds only while app1-bu is retained. Decision open
+  (migration plan Q4). New customer-facing host: **app4** `159.195.205.80` (netcup RS 4000 G12, Nuremberg).
 - **app3 MySQL:** Root password in Vaultwarden + `/root/.my.cnf` on app3, accessible via 127.0.0.1:3306.
 - **CloudPanel:** SQLite DB at `/home/clp/htdocs/app/data/db.sq3` — users live here, not in MySQL.
 - **AWS CLI PATH:** All backup scripts must use `/opt/awscli-venv/bin/aws` or `source /opt/awscli-venv/bin/activate` — `aws` bare fails in cron context (PATH doesn't include venv bin). Documented in server-provisioning-standard v1.3.0.